I think the bypass codepaths (virtio->nat->bypass->iplib->nettrans)
consumed too much stack, and a thread went off the bottom of the page. I
had a user PF at RIP = 8 and RSP right at the top of a page. Increasing
the stack size removed the symptom.